WP SendFox

WP SendFox has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 4.8, and the most serious one scores 5.3 out of 10. 2024 was the busiest year with 2 disclosures.

The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2024.

2 independent researchers contributed these findings, one record each. WP SendFox is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.10.

Strategic Overview

Avg CVSSMedium

4.8/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all WP SendFox vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2024-49284

WP SendFox <= 1.3.1 - Unauthenticated Information Disclosure

Read the full analysis

Vulnerability Records

2 records


2024-10-15 00:00	WP SendFox <= 1.3.1 - Unauthenticated Information Disclosure WP SendFox <= 1.3.1	`CVE-2024-49284`	5.3 Medium	Joshua Chan	No
2024-03-13 00:00	WP SendFox <= 1.3.0 - Missing Authorization WP SendFox <= 1.3.0	`CVE-2024-27970`	4.3 Medium	Abdi Pranata	Yes

Showing 1–2 of 2 reports

Latestv1.3.1

WP SendFox

Author

BogdanFix

5.0(8)

100/100

Last Updated

2024-03-07 (3y ago)

Active Installs

1,000+

Downloads

18,350

Requires WP

4.6+

Requires PHP

5.2.4+

Tested up to

WP 6.4.10

Created

2020-03-06 (7y ago)

This plugin lets you capture emails from your WP comment form, WP registration form, WooCommerce checkout form, pages built with Gutenberg and Divi Builder. You can: * add subscribe checkbox to any of these forms * make it pre-checked * make subscription implicit (hidden checkbox) Also you can easily export your WordPress users and/or WooCommerce customers to one of your lists in just 3 clicks, literally. All you need to start using this plugin is your SendFox API key (aka “Personal Access Token”). SendFox website, title and logo are owned by Sumo Group, Inc.

View on WordPress.org